From owner-freebsd-questions Thu Jan 18 13:59:33 2001 Delivered-To: freebsd-questions@freebsd.org Received: from clmboh1-smtp3.columbus.rr.com (unknown [65.24.0.112]) by hub.freebsd.org (Postfix) with ESMTP id 54FAB37B698 for ; Thu, 18 Jan 2001 13:59:14 -0800 (PST) Received: from mail.iowna.com (dhcp065-024-023-038.columbus.rr.com [65.24.23.38]) by clmboh1-smtp3.columbus.rr.com (8.11.2/8.11.2) with ESMTP id f0ILuq719490; Thu, 18 Jan 2001 16:56:52 -0500 (EST) Message-ID: <3A676681.A7EB136B@mail.iowna.com> Date: Thu, 18 Jan 2001 16:56:17 -0500 From: Bill Moran X-Mailer: Mozilla 4.76 [en] (X11; U; FreeBSD 4.2-STABLE i386) X-Accept-Language: en MIME-Version: 1.0 To: Trevin Chow Cc: questions@FreeBSD.ORG Subject: Re: NAT doesn't work with my firewall rules? References: <5.0.2.1.2.20010118130802.02bfc808@mail.brightmail.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Trevin Chow wrote: > Here's a SNIPPET of my rules leading up to the divert nat rule and a few > rules after: From "snippet", I would assume that there are more rules? Hopefully, because what you've got below would block just about everything (if the last rule is "deny all from any to any" - which it usually is) Post the full ruleset to the list. Also, what IP pool are you using on the internal interfaces? > > ------ > allow ip from any to any via lo0 > divert 8668 ip from any to any via dc0 > deny ip from any to 127.0.0.0/8 > deny ip from 192.168.0.0/24 to any in recv dc0 > deny ip from 209.53.0.0/18 to any in recv fxp0 > deny ip from 209.53.0.0/18 to any in recv fxp1 > deny ip from 192.168.0.0/16 to any in recv dc0 > deny ip from 172.16.0.0/12 to any in recv dc0 > deny ip from 224.0.0.0/4 to any > deny ip from 10.0.0.0/8 to any in recv dc0 > allow ip from any to any out xmit dc0 > allow ip from any to any via fxp0 > ------ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message